Home CTEM Internal ASM CAPTAS AI Dark Web Monitor Our Story Case Studies Blog Contact Request Demo
Internal ASM — 02 of 04

Inside the perimeter. Fully mapped.

Secure what’s behind the perimeter. Map every internal asset, detect lateral movement in real time, and prioritize vulnerabilities with CVSS+ scoring before threats spread across your network — 100% on-premises.

0
On-premises — zero
data leaves your network
0
Internal attack paths
identified and mapped
0
Faster lateral movement
detection vs manual
0
Average time to full
internal surface map
What Internal ASM Covers

Most tools stop at the perimeter.
Attackers don’t.

68% of successful attacks exploit internal misconfigurations that perimeter tools never see. Internal ASM maps every asset, service, subnet, and lateral movement path inside your infrastructure — deployed entirely within your own environment.

01 — Endpoint Discovery

Every internal asset. Agentless or agent-based.

Deploy with zero infrastructure changes. Internal ASM uses passive network discovery and optional lightweight agents to build a complete inventory of every device, service, and application inside your network — including cloud workloads.

Agentless passive discovery via network scanning
Optional lightweight agents deployable via MDM or Ansible
Cloud workload discovery — EC2, Azure VMs, GCP Compute
Container and Kubernetes surface mapping
Active Directory and LDAP asset enumeration
Internal Network MapScanning
Endpoints found3,847
Subnets mapped48 / 52
Cloud workloads284
Containers1,204
AD objects12,443
Unknown devices47 flagged
02 — Lateral Movement

Detect every path an attacker could take inside.

Once inside, attackers move laterally — from a compromised workstation to a domain controller, from a misconfigured service account to production databases. Internal ASM maps every path before it’s used.

Lateral movement path enumeration across all subnets
Privilege escalation path detection — sudo, SUID, ACLs
Service account and credential exposure mapping
Network segmentation gap analysis
Exfiltration path identification
Lateral MovementAnalyzing
Lateral paths23 confirmed
Privesc paths7 found
Seg. gaps4 subnets
Svc accounts3 over-privileged
Exfil paths3 to internet
Risk score
82
03 — Vulnerability Detection

CVSS+ scoring with real business impact weighting.

Raw CVSS scores don’t reflect your environment. CVSS+ overlays exploitability intelligence, asset criticality, network position, and business impact to surface the vulnerabilities that matter most — not just the highest-numbered ones.

Vulnerability detection across all discovered assets
CVSS+ scoring with business impact weighting
Exploitability intelligence from real-world threat data
Misconfiguration detection — services, permissions, certs
Patch status tracking and remediation workflow
iasm-scanner v2.8 — internal
iasm scan --subnet 10.0.0.0/8 --mode deep
✓ Discovered 3,847 live hosts
✗ 10.0.4.22 — sudo NOPASSWD — privesc to root
✗ 10.0.1.88 — docker socket exposed — container escape
⚠ 10.0.2.0/24 — no firewall rule separation from prod
✓ Routing findings → Jira AL-2041, AL-2042
→ Full report generated: iasm-report-2025.pdf
Zero Data Egress

100% on-premises.
Air-gapped available.

Internal ASM is deployed entirely within your own infrastructure. No network data, agent telemetry, or scan results ever leave your environment. For classified or high-security deployments, a fully air-gapped option is available.

Cloud Deployment
Standard On-Prem
Deployed in your VPC or data center. Management plane stays inside your network. API available for integration.
High Security
Air-Gapped
Zero external network connectivity. Self-contained deployment package. Update feeds delivered via secure removable media.
Enterprise
Multi-Tenant
Separate deployment per business unit or subsidiary. Centralized reporting with strict data isolation between tenants.

See what’s hiding inside.

Internal ASM gives you complete visibility of your internal attack surface. 100% on-premises. No data egress. Air-gapped available.

Start Request Demo Talk to the Team →
Also In The Platform

Complete coverage across
every attack surface.